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(57) ABSTRACT 

A method for monitoring communication performance in a 
communication network comprising computer systems com- 
municatively coupled to each other with communication 
equipment. In one embodiment, a computer system of a 
communication network measures and time-stamps network 
performance statistics and stores them in a memory unit 
within the computer system. The computer system also 
measures and time-stamps system performance statistics and 
system parameters and stores them in the memory unit 
within the computer system. The computer system reports 
the network performance statistics and the system informa- 
tion to a central computer system at specified time intervals. 
The central computer system correlates the network perfor- 
mance statistics and the system information for a specified 
time period based on the time-stamping and stores the 
network performance statistics and the system information 
in a memory unit within the computer system. The central 
computer system displays the correlated network perfor- 
mance statistics and system information to a user in response 
to the identification of a perturbation in the communication 
network, where the correlated network performance statis- 
tics and system information are displayed for a time interval 
contemporaneous with the perturbation, so that the user can 
integrally analyze the information. 

25 Claims, 8 Drawing Sheets 
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INTEGRATED COMPUTER SYSTEM AND ment services is measured. These metrics are used to quan- 

NETWORK PERFORMANCE MONITORING tify standards of performance that allow businesses to assess 

not only the performance of the network but also the 

TECHNICAL FIELD performance of the network management services provider. 

The present invention relates to the field of computer 5 p ? or 311 network management tools generally do not pro- 

system communication networks. In particular, the present vidc effective means for monitoring the network and facili- 

invention pertains to computer system and network moni- tatin 8 compliance with the requirements contained in the 

toring and management. SLAs. 

The prior art network monitoring and management tools 
are problematic because they do not provide the network 

Computer systems linked to each other in a communica- manager with sufficient and readily accessible information 

tion network are commonly used in businesses and like enabling him/her to quickly pinpoint the source of a problem 

organizations. Computer system communication networks and solve il - In tne P r i° r art, the network manager must look 

("networks") are growing in size — as measured by the at various sources of information, typically beginning with 

number of applications and the number of users they 15 available network information from the RMON probes, to 

support — due to improvements in network reliability and the trv t0 identify the cause of a problem. Once the network 

recognition of associated benefits such as increased produc- manager reviews the network information available, only 

tivity. then may he or she conclude that the problem is not with the 

As the size of networks increases and as organizations on network ec l ui Pment but with a server or client computer 

become more reliant on such networks, the importance of ^ stcm on ^ network - At this point, the network manager 

effective network management tools also grows. In response ( or aQ equivalent system manager) begins a lengthy process 

to the need for standardization of such tools, primarily to of researching potential causes from the system perspective, 

control costs but also because components in a network are WhUe there ma y be ™ mt de S ree of manual coordination of 

likely to originate from many different vendors, the Simple „ the network and svstem cfforts to ldentifv the cause of a 

Network Management Protocol (SNMP) was developed and P^Wem, the network tools m the prior art are not capable of 

widely adopted. There have been a number of management automatically facilitating a coordinated effort to an extent 

information bases (MIBs) defined since adoption of SNMP, 15 °P*™™- m the prior art it is not possible to 

such as MIB-II, Remote Network Monitoring (RMON), and <l uickl y md automatically pinpoint a problem as either a 

RMON2 network problem or a system problem. 

SNMP, RMON and RMON2 thus are network manage- 3 ° Timel y correction of problems on a network is essential, 

ment software tools that provide a set of standards for because of the effect on user productivity and the desire for 

network management and control, including a standard fast servicc that is prevalent among users. Service level 

protocol, a specification for database structure, and a set of agreements also place a premium on timely resolution of 

data objects. RMON and RMON2 are implemented in a 35 network problems. Thus, the prior art techniques for moni- 

network through MIBs which contain instructions specify- torm S networks and identifying problems and their causes 

ing the data that are to be collected, how the data are to be are not r es P°°sive to the requirements of the users and the 

identified, and other information pertinent to the purpose of busmess served by the network. The prior art techniques are 

network monitoring. In the prior art, the MIBs are imple- also not responsive to the needs of the network and/or 

mented through RMON probes to monitor the local areas of 40 svstem who are charged with accomplishing 

the network. (An RMON probe typically is a computer timelv identification and resolution of problems, 

system strategically located within the network so as to Another disadvantage to the prior art is that the RMON 

monitor a local area of the network.) The network monitor- probes are capable only of monitoring network performance, 

ing information obtained by the RMON probes is The RMON probes cannot monitor the performance of client 

communicated- to a central computer system that is acces- 45 an d server computer systems and communicate information 

sible by the network manager. about system performance to the central computer system 

Prior art network monitoring and management tools have used b y tne network manager. Therefore, in the prior art, the 

trouble aiding the network manager in determining whether monitoring tools do not provide information about system 

a problem within the network is associated with the network performance. 

equipment itself or with the computer systems coupled to the 50 In one prior art system, a server computer system and a 

network. If this information were known, it would allow the client computer system send messages, commonly referred 

network manager to identify and implement the appropriate to as "heartbeats," to each other to affirm that a connection 

corrective action. For example, if a user places a request for exists and that both computer systems are functioning, 

a particular application from a client computer system to a However, the heartbeats only communicate between the 

server computer system and a response is delayed or is not 55 lower levels of software in the computer systems (e.g., 

received, the prior art network management tools do not give between the protocol stacks), and so do not provide an 

the network manager enough information to identify indication of a possible problem at the higher levels of 

whether the problem is occurring because of a bottleneck in software, such as "memory thrashing" in the central proces- 

the network equipment or because the client or server sor unit of a computer system. Hence, a computer system 

computer system is not functioning properly. $o may in fact be experiencing a problem that would not be 

Effective network monitoring and management tools are detectable in the prior art, and the network/system manager 

also needed in order for vendors of network management mav conclude based on the information available that the 

services to demonstrate compliance with the governing computer system is functioning satisfactorily, 

service level agreement (SLA). Many businesses contract Another drawback to the prior art is that the limited 

with vendors for network management services. Such con- 65 network and system information that is available to the 

tracts are typically implemented with SLAs which specify network manager is not historical; that is, information 

metrics against which the provider of the network manage- regarding the recent performance of the network and system 
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preceding the occurrence of a problem is not retrievable by of the invention and, together with the description, serve to 

the network manager. As such, the network manager can explain the principles of the invention: 

only view network or system performance after a user has FIG. 1 shows a general purpose computer system upon 

identified a problem. Thus, in the prior art, valuable histori- which embodiments of the present invention may be prac- 

cal information that may aid the network manager in under- 5 ticcd. 

standing the source of a problem is not available. FIG. 2 is a diagram of an exemplary computer system 

Thus, a need exists for a method to monitor a computer communication network upon which the present invention 

system communication network that readily detects a prob- mav be practiced, 

lem and permits the network manager to quickly identify the V jr i ,v n e „ « * t i 

J*. . , - . b • 7 r tL j 4 < t in 3 is a diagram or a segment of an exemplary 

cause of the problem. A need further exists for a method that 10 „ • »• . i L - f 

, v . t . , , , , computer system communication network upon which the 

accomplishes the above and enables the network manager to u ♦ ■ j 

, , , v . . - 1 . fe present invention may be practiced, 

demonstrate compliance with the provisions of the govern- r 

ing SLA. A need yet exists for a method that accomplishes . ™- 4 15 a definin g network Performance statis- 

the above and is compatible with the SNMP protocol that is Ucs for an exemplary computer system communication 

currently employed. The present invention solves these 15 network upon which the present invention may be practiced, 

needs. These and other objects and advantages of the present FIG 5 is an illustration of a network performance statis- 

invention will become obvious to those of ordinary skill in tics data table in accordance with one embodiment of the 

the art after having read the following detailed description of present invention. 

the preferred embodiments which are illustrated in the FIG. 6 is an illustration of a system information host 

various drawing figures. 2,0 group in accordance with one embodiment of the present 

DISCLOSURE OF THE INVENTION invention. 

^ . . ., - . A . FIG. 7 is a flow chart of a process for collecting network 

The present invention prov.des a method to monitor a performancc statistics and ? em mformation m accordance 

computer system communication network that read>ly with one embodiment of the present invention. 

detects a problem and permits the network manager to 25 _ _ _ . , _ 

quickly identify the cause of the problem. The present FIG. 8 is a flow chart of a process for correlating network 
invention also provides a method that accomplishes the performance statistics and system information in accordance 
above and enables the network manager to demonstrate Wlth one embodiment of the present invention, 
compliance with the provisions of the governing service BEST MODE FOR CARRYING OUT THE 
level agreement (SLA). Finally, the present invention pro- 30 INVENTION 
vides a method that accomplishes the above and is cost- 
effective and compatible with the Simple Network Manage- Reference will now be made in detail to the preferred 
ment Protocol that is currently employed in many embodiments of the invention, examples of which are illus- 
communication networks. trated in the accompanying drawings. While the invention is 
The present invention described herein provides a method 35 described in conjunction with the preferred embodiments, it 
for quantifying communication performance in a commu- 13 understood that they are not intended to limit the invention 
nication network having computer systems communica- t0 these embodiments. On the contrary, the invention is 
tively coupled to each other with communication equipment. intended to cover alternatives, modifications and 
In one embodiment, a computer system of a communication equivalents, which may be included within the spirit and 
network measures and time-stamps network performance «o SC0 P e of the invention as defined by the appended claims, 
statistics and stores them in a memory unit within the Furthermore, in the following detailed description of the 
computer system. The computer system also measures and P rcscnt invention, numerous specific details are set forth in 
time-stamps system performance statistics and system order to provide a thorough understanding of the present 
parameters and stores them in the memory unit within the invention. However, it will be obvious to one of ordinary 
computer system. The computer system reports the network 45 skill in the art that the present invention may be practiced 
performance statistics and the system information to a without these specific details. In other instances, well-known 
central computer system at specified time intervals. The methods, procedures, components, and circuits have not 
central computer system correlates the network performance been described in detail so as not to unnecessarily obscure 
statistics and the system information for a specified time as P ects of the present invention. 

period based on the time-stamps. The central computer 50 Some portions of the detailed descriptions which follow 

system displays the correlated network performance statis- are presented in terms of procedures, logic blocks, 

tics and system information to a user in response to the processing, and other symbolic representations of operations 

identification of a perturbation in the communication on data bits within a computer memory. These descriptions 

network, where the correlated network performance statis- a nd representations are the means used by those skilled in 

tics and system information are displayed for a time interval 55 the data processing arts to most effectively convey the 

contemporaneous with the perturbation, so that the user can substance of their work to others skilled in the art. A 

integrally analyze the information. procedure, logic block, process, etc., is here, and generally, 

In one embodiment, the method provided by the present conceived to be a self-consistent sequence of steps or 

invention and described above is implemented using a instructions leading to a desired result. The steps are those 

management information base (MIB) extension to Remote 60 requiring physical manipulations of physical quantities. 

Network Monitoring (RMON)-based software, where the Usually, though not necessarily, these quantities take the 

RMON MIB specifies the system information to be mea- form of electrical or magnetic signals capable of being 

sured and stored. stored, transferred, combined, compared, and otherwise 

m manipulated in a computer system. It has proven convenient 

BRIEF DESCRIPTION OF THE DRAWINGS 65 at ^ principally £ r rea / ons of comm P on usage> to refer 

The accompanying drawings, which are incorporated in to these signals as bits, bytes, values, elements, symbols, 

and form a part of this specification, illustrate embodiments characters, terms, numbers, or the like. 



11/06/2003, EAST Version: 1.4.1 



US 6,2( 

5 

It should be borne in mind, however, that all of these and 
similar terms are to be associated with the appropriate 
physical quantities and are merely convenient labels applied 
to these quantities. Unless specifically stated otherwise as 
apparent from the following discussions, it is appreciated 
that throughout the present invention, discussions utilizing 
terms such as "processing" or "computing" or "calculating" 
or "determining" or "displaying" or the like, refer to the 
action and processes of a computer system (e.g., processes 
of FIGS. 7 and 8), or similar electronic computing device, 
that manipulates and transforms data represented as physical 
(electronic) quantities within the computer system's regis- 
ters and memories into other data similarly represented as 
physical quantities within the computer system memories or 
registers or other such information storage, transmission or 
display devices. 

Refer to FIG. 1 which illustrates a host computer system, 
client computer system 110 (the following discussion is also 
pertinent to a server computer system and a central computer 
system). In general, client computer system 110 used by the 
embodiments of the present invention comprises a bus 100 
for communicating information, a central processor 101 
coupled with bus 100 for processing information and 
instructions, a random access memory 102 coupled with bus 
100 for storing information and instructions for central 
processor 101, a read-only memory 103 coupled with bus 
100 for storing static information and instructions for central 
processor 101, a data storage device 104 such as a magnetic 
or optical disk and disk drive coupled with bus 100 for 
storing information and instructions, a display device 105 
coupled to bus 100 for displaying information to the com- 
puter user, an optional alphanumeric input device 106 
including alphanumeric and function keys coupled to bus 
100 for communicating information and command selec- 
tions to central processor 101, an optional cursor control 
device 107 coupled to bus 100 for communicating user input 
information and command selections to central processor 
101, and a network interface card (NIC) 108 coupled to bus 
100 for communicating from a , communication network to 
central processor 101. 

Display device 105 of FIG. 1 utilized with client computer 
system 110 of the present invention may be a liquid crystal 
device, cathode ray tube, or other display device suitable for 
creating graphic images and alphanumeric characters rec- 
ognizable to the user. Cursor control device 107 allows the 
computer user to dynamically signal the two-dimensional 
movement of a visible symbol (pointer) on a display screen 
of display device 105. Many implementations of the cursor 
control device are known in the art including a trackball, 
mouse, joystick or special keys on alphanumeric input 
device 106 capable of signaling movement of a given 
direction or manner of displacement. It is to be appreciated 
that the cursor means 107 also may be directed and/or 
activated via input from the keyboard using special keys and 
key sequence commands. Alternatively, the cursor may be 
directed and/or activated via input from a number of spe- 
cially adapted cursor directing devices. 

With reference now to FIG. 2, a diagram showing client 
computer system 110 coupled to server computer system 
250 in communication network 205 is provided. In a typical 
communication network, there are a plurality of host com- 
puter systems, e.g., client computer systems and server 
computer systems, that are coupled to each other with 
communications equipment. For the discussion herein, a 
single client computer system 110 is shown coupled via 
communications lines 240 and 242 with a single server 
computer system 250, but more computer systems could be 
employed. 
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With reference still to FIG. 2, the software executed by 
central processor 101 (FIG. 1) of client computer system 110 
is represented by application layer 210 which is separated 
from the remainder of protocol stack 220. Application layer 

S 210 defines the manner in which network applications 
interact with the communication network, where network 
applications include computer software programs, word 
processors, database management systems, electronic mail, 
and the like. Protocol stack 220 contains the remaining 

10 layers of software that define the computer-to -computer or 
computer-to-network protocol, where protocol defines the 
procedures to be followed when data are transmitted and 
received. In a similar manner, server computer system 250 
includes application layer 260 and protocol stack 270. 

15 Continuing with reference to FIG. 2, one of the software 
layers (e.g., application layer 210) of client computer system 
110 transmits a request to server computer system 250 in the 
form of request data packet 290, and server computer system 
250 responds to the request in the form of response data 

20 packet 295. In this example, request data packet 290 and 
response data packet 295 are shown traveling by different 
communications lines (e.g., in a switched network 
environment), but it is appreciated that in the present inven- 
tion the data packets alternatively can travel over the same 

25 communications line. 

FIG. 3 shows segment 305 of a communication network 
including host computer systems exemplified by client com- 
puter systems 110, 110a, and 11 Ofc and server computer 
system 250, and central computer system 300 that is alter- 

30 natively referred to as an "edge monitor." A communication 
network typically includes communicatively coupled 
switches, routers and additional segments (not shown). Edge 
monitor 300 receives information from multiple network 
segments. 

35 The present invention includes a method for monitoring 
communication performance in a communication network 
such as that exemplified by FIG. 3. In accordance with the 
present invention, a host computer system (e.g., client 
computer system 110 or server computer system 250) mea- 

40 sures and stores network performance statistics. The host 
computer system also measures and stores historical infor- 
mation including system information consisting of system 
performance statistics and system parameters. In the present 
invention, the network and system information are commu- 

45 nicated to a central computer system (e.g., edge monitor 
300), where the information is stored and catalogued in a 
manner that identifies the host computer system providing 
the information and the time period over which the infor- 
mation was measured by the host computer system. In 

50 accordance with the present invention, the network and 
system information is correlated so that it can be integrally 
analyzed. Based on the analysis, the present invention thus 
permits the network manager to make conclusions regarding 
the performance of the communication network and the 

55 cause of a network problem. 

NETWORK PERFORMANCE STATISTICS- 
DEFINITION 

With reference now to FIG. 4, client computer system 110 
is coupled to server computer system 250 in a communica- 

60 tion network (e.g., communication network 205 of FIG. 2). 
A data packet takes a measurable amount of time to travel 
from client computer system U0 to server computer system 
250, and vice versa. It also takes a measurable amount of 
time for a computer system to perform an application. 

65 Continuing with reference to FIG. 4, "protocol latency" is 
the amount of time for a data packet to travel one-way 
through a protocol stack of a computer system. Hence, 
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protocol latency is the amount of time for a data packet to tions referenced above, the difference between two time- 

travel from point A to point B or from point B to point A in stamps is used to measure the time for a data packet to travel 

protocol stack 220, or from point D to point E or point E to from one of the points designated in FIG. 4 to another 

point D in protocol stack 270. designated point. 

With reference to FIG, 4, "application processing time" is 5 NETWORK PERFORMANCE STATISTICS— 

the time required for server computer system 250 to com- OPERATION 

plete performing a network application in response to a Refer now to FIG. 5, which illustrates the memory 

request received from client computer system 110. In one structure of the present embodiment of the present invention 

embodiment of the present invention, application processing within the computer-readable memory units of client com- 

time is the elapsed time period between the time when 10 puter system 110 and also in server computer system 250 of 

request data packet 290 enters application layer 260 of FIG. 2. In one embodiment, data table 540 is used to store 

server computer system 250 and the time when the corre- entries consisting of the time difference between time- 

sponding response data packet 295 exits application layer stamps. In one embodiment, data table 540 is alternatively 

260 of server computer system 250 (one-way from point D referred to as a response time buffer, 

to point D'). In another embodiment, application processing 15 In the present embodiment, statistics table 550 is used to 

time is the period from the time when the application store performance statistics that are based on the information 

program interface of server computer system 250 issues a stored in data table 540 or in a response time buffer. At a time 

receive socket call corresponding to request data packet 290 interval specified by the network manager, the performance 

to the time when the application program interface of server statistics in statistics table 550 are read to user-history table 

computer system 250 issues a send socket call correspond- 20 560. In the present embodiment, statistics table 550 accu- 

ing to response data packet 295. mulates the minimum, maximum, average and median for 

With reference still to FIG. 4, in one embodiment of the the entries stored in data table 540. The information stored 
present invention, "application response time" is the elapsed in statistics table 550 is collected for a specified time 
time period between the time when request data packet 290 interval, and then read to user-history table 560. In user- 
exits application layer 210 of client computer system 110 25 history table 560, a set of data are stored for each of a 
and the time when response data packet 295 enters appli- plurality of time intervals. The set of data stored for each 
cation layer 210 of client computer system 110 (round trip time interval may also be combined to compute data for a 
from point A to point C), where response data packet 295 is longer time interval. The data stored in user-history table 
sent in response to request data packet 290. In another 560 are time-stamped to indicate the time interval corre- 
embodiment, application response time is the time period 30 sponding to each set of data. Thus, the data can be sorted 
between when the application program interface of client according to the time interval during which it was collected, 
computer system 110 generates a send socket call corre- At a time interval specified by the network manager, the 
sponding to request data packet 290 and a receive socket call data stored in user-history table 560 are read to a central 
corresponding to receive socket call 295. computer system (e.g., central computer system, or edge 

With reference to FIG. 4, "network latency" is the amount 35 monitor, 300 of FIG. 3). 

of time required for the data packet to travel from point B at SYSTEM INFORMATION— DEFINITION 

which it exits one computer system to point E at which it In addition to the network performance statistics 

enters another computer system, e.g., the time to travel described above, system information consisting of system 

one-way from network interface card 108 in client computer performance statistics and system parameters are measured 

system 110 of FIG. 1, to the network interface card in server 40 by a host computer system and communicated to a central 

computer system 250, and vice versa. computer system in accordance with the present invention. 

The network performance statistics named above are In the present embodiment of the present invention, 

determined as described in the copending patent application "system performance statistics" generally describe dynamic 

filed concurrently herewith and assigned to the assignee of data collected by a host computer system (e.g., client com- 

the present invention, entitled "Application Response Time 45 puter system 110 or server computer system 250 of FIG. 2) 

and Network Latency Monitoring Using End-Node Com- regarding its own performance. For example, system per- 

puter Systems," by Richard A, Fletcher and Prakash C. formance statistics include the number of errors or the 

Banthia, with Ser. No. 09/141,968, and as described in the number of page faults that occur for a computer system 

copending patent application filed concurrently herewith, during a time interval specified by the network manager, 

assigned to the assignee of the present invention, entitled 50 System performance statistics are periodically commum- 

"Method for Analyzing Network Application Flows in an cated to a central computer system (e.g., edge monitor 300 

Encrypted Environment," by Richard A. Fletcher and Carl of FIG. 3) at a time interval specified by the network 

Lin, with Ser. No. 09/143,273, both of which are hereby manager. System performance statistics collected in one 

incorporated by reference, and they still pending. embodiment of the present invention are described in the 

As described by the copending patent applications named 55 Code Sections below. In alternative embodiments, addi- 

above, in one embodiment the network performance statis- tional system performance statistics are specified, 

tics are determined using time-stamps that are applied by the In the present embodiment, "system parameters" gener- 

client and server computer systems (e.g., client computer ally describe static information or information that does not 

system 110 and server computer system 250 of FIG. 2) to the frequently change that is collected by a host computer 

request and response data packets (e.g., request data packet 60 system (e.g., client computer system 110 or server computer 

290 and response data packet 295 of FIG. 2). In another system 250) regarding its own hardware and software capa- 

embodiment, the network performance statistics are deter- bilities. For example, system parameters include the quantity 

mined using time-stamps that are applied by client computer of memory available in a data storage device of a host 

system 110 and server computer system 250 to the socket computer system (e.g., datastorage device 104 of FIG. 1) or 

calls that are issued by the application program interface 65 the quantity of random access memory available in a com- 

corresponding to request data packet 290 and response data puter system (e.g., random access memory 102 of FIG. 1). 

packet 295. As described in the copending patent applica- System parameters also describe the number of applications 
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or the number of processes residing in a computer system. 
In one embodiment, system parameters are periodically 
communicated to a central computer system (e.g., edge 
monitor 300 of FIG. 3) at a time interval specified by the 
network manager. In one embodiment, system parameters 
are only communicated to a central computer system when 
they change from a value previously reported to the central 
computer system. System parameters collected in one 
embodiment of the present invention are described in the 
Code Sections below. In alternative embodiments, addi- 
tional system parameters are specified. 

In the present embodiment, the present invention uses an 
extension to an RMON MIB to implement the method and 
architecture for specifying and collecting the system infor- 
mation (system performance statistics and system 
parameters) to be measured. As previously discussed, 
RMON is a supplement to the SNMP protocol currently 
employed in computer system communication networks, 
and thus the present embodiment of the present invention is 
compatible with the standards currently in use. In the present 
embodiment, the RMON MIB is implemented in the client 
and server computer systems in accordance with the appli- 
cation Title-TBD, Filing Date Jun. 24, 1997, Ser. No. 
08/882,207, which is hereby incorporated by reference. 
Hence, the present embodiment of the present invention 
does not require additional hardware and so provides a 
cost-effective method for monitoring network and system 
performance. 

The RMON MIB specified in accordance with the present 
embodiment is described in the Code Sections below. 

Code Section A — RMON MIB Extension in 
Accordance with One Implementation of the 
Present Invention 



FROM SNMPv2-SMI 



FROM SNMPv2-TC 
FROM RMON-MIB; 



IMPORTS 

MODULE-IDENTITY, OBJECT-TYPE, 

Countcr32, Integcr3 

Display String, TimeStamp 

hostControlEntry, bostControlIndex 
-- System Management and Performance Monitoring MIB 

- DESCRIPTION 

- "This MIB module, System Management and Performance Monitoring, 
-- integrates with Application Response Time MIB to allow the 

-- IT Manager to quickly differentiate between network problems and 

- system problems in a client-server environment." 
--::«{ genExperimental 16 } 

org OBJECT IDENTIFIER : : = { iso 3 } 
dod OBJECT IDENTIFIER : : = { org 6 } 
internet OBJECT IDENTIFIER : : » { dod 1 } 

OBJECT IDENTIFIER : : = { internet 2 } 
OBJECT IDENTIFIER : : = { mgmt 1 } 
OBJECT IDENTIFIER : : = { mib-2 16 } 
OBJECT IDENTIFIER : : = { rmon 4 } 
OBJECT IDENTIFIER : : - { hosts 4 } 
OBJECT IDENTIFIER : : «> { sys 1 } 
OBJECT IDENTIFIER : : = { sys 2 } 
OBJECT IDENTIFIER : : = { sys 3 } 
OBJECT IDENTIFIER : : - { sys 4 } 
OBJECT IDENTIFIER : : » { sys 5 } 
OBJECT IDENTIFIER : : - { sys 6 } 
OBJECT IDENTIFIER : : - { sys 7 } 
OBJECT IDENTIFIER : : - { sys 8 } 



mgmt 

mib-2 

rmon 

hosts 

sys 

descr 



cpu 
mem 
drive 
app 

process 

error 
Access privileges: 
level 1: no access 
level2: read-only access 
level3: read- write access 
leve!4: read- write access 



Code Section below. The Description Group lists the inven- 
tory of the computer system and includes a description table, 
a processor table, and an input/output bus table. 

Code Section B — Description Group 



- Description Table 
10 descrTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DescrEntry 

MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists the inventory of the system." 
15 { descr 1 } 

descrEntry OBJECT-TYPE 

SYNTAX DescrEntry 
MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the descrTable." 
INDEX { syslndex, sys Address } 
:> { descrTable 1 } 
DescrEntry ::- SEQUENCE { 



25 



30 } 



45 



syslndex 
sysAddress 
descrSys temName 
descrOSType 
descrOSVersion 
descrSys temDescr 
descrFirmwarc Descr 
descr Pro ccssorNumbcr 
descr lOBus Number 



Integer32, 

PhyAddress, 

DisplayString, 

DisplayString, 

DisplayString, 

DisplayString, 

DisplayString, 

Integer32, 

Integer32 



sysIndcxOBJECT-TYPE 

SYNTAX PhysAddress 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 
35 "The set of collected host statistics of which 

this entry is a part. The set of hosts 
identified by a particular value of this 
index is associated with the RMON hostControlEntry 
as identified by the same value of hostControllndex. 
In other words, it refers to an interface of the RMON probe." 
{ descrEntry 1 } 
sysAddress OBJECT-TYPE 

SYNTAX PhysAddress 
MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"Same as MIB-II ifPhys Address, this is the physical address of 
this system. This address is at the protocol layer immediately 
'below' the network layer in the protocol stack. 
Example showing an Ethernet MAC address: 
<0x00>^)xc0><0x4f><0xac><0xa6><0xcl> 

:> { descrEntry 2 } 
50 descrSystemNarne OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The name of the system." 
55 :> { descrEntry 3 } 
descrOSType OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The operating system type of the system. 
Examples: 'Microsoft Windows NT Workstation \ 

'Microsoft Windows NT Server (Domain 
Controller)', 

'Microsoft Windows NT Server (Stand-alone)', 
'Microsoft Windows 95', 
'Unknown'." 



The Description Group of the RMON MIB specified in 
accordance with the present embodiment is described in the 



::= { descrEntry 4 } 
descrOSVersion OBJECT-TYPE 
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-continued 



-continued 



SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

'The operating system version of the system. 

Examples: '4.0 (Build 1381: Service Pack 3) Uniprocessor 
Free', 

'4.00.950 B\ 
'4.00.950', 
'Unknown'." 
::= { descrEntry 5 } 
descrSystemDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (p.. 127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The manufacturer, product name and model of the system. 
Example: 'Dell GXa 300MTbr\" 
::= { descrEntry 6 } 
descrFirmwareDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The manufacturer, product name and version of the system 
firmware. 

Example: 'Phoenix BIOX PLUS Version 1, 09/19/977' 
:> { descrEntry 7 } 
descrProcessorNumber OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of processors (regardless of their current state) 

present in this system. 

Example: 1 

::= { descrEntry 8 } 
descrlOBusNumber OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of Input Output Buses (regardless of their current 
state) present in this system. 
Example: 1 

::= { descrEntry 9 } 
-- Processor Table 

descrProcessorTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DescrPro cesser Entry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A table that lists the processors of the system." 

::= { descr 2 } 
descrProcessorEntry OBJECT-TYPE 

SYNTAX DescrProcessorEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the descrProcessorTable." 

INDEX { sys Index, sys Address, descrProcessorlndex } 

::- { descrProcessorTable 1 } 
DescrProcessorEntry : > SEQUENCE { 

descrProcessorlndex Intcgcr32, 

descrProcessorDescr DisplayString, 

descrProcessorClockSpced Integer32 

} 

descrProcessorlndex OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX- ACCESS not- accessible 

STATUS current 

DESCRIPTION 

"An index that uniquely identifies a particular processor of the 
system uniquely identified by syslndex and sysAddress." 

::» { descrProcessorEntry 1 } 
descrProcessorDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 



MAX-ACCESS read-only 
STATUS current 
5 DESCRIPTION 

"Manufacturer and family of the processor. 
For Windows NT, processor revision is also included. 
Examples: 'Intel Pentium Model 4 Stepping 4' 
'Intel 80486'." 
::= { descrProcessorEntry 2 } 
10 descrProcessorClockSpeed OBJECT-TYPE 

SYNTAX Integer32 (-1.. 21 47483 647) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Clock speed (in Mhz) of the processor. -1 means that the clock 
15 speed is greater than 0 but less than 1 Mhz. 

Example: 300 

::= { descrProcessorEntry 3 } 
- 10 Bus Table 

descrlOBusTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DescrlOBusEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists the IO Buses of the system." 
::- { descr 3 } 
descrlOBusEntry OBJECT-TYPE 
25 SYNTAX DescrlOBusEntry 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the descrlOBusTable." 
INDEX { syslndex, sysAddress, dcscrlOBusIndex } 
30 ::= { descrlOBusTable 1 } 

DescrlOBusEntry ::= SEQUENCE { 
dcscrlOBusIndex Integer32, 
dcscrlOB us Descr DisplayString 

} 

descrlOBusIndex OBJECT-TYPE 
35 SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"An index that uniquely identifies a particular IO Bus of the 
system uniquely identified by syslndex and sysAddress." 
::» { descrlOBusEntry 1 } 
descrlOBusDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Description of the IO Bus by including the bus type, bus width, 
and bus speed 

Example: 'PCI 32-bit 33MHz\" 
::= { descrlOBusEntry 2 } 



40 



45 



50 



55 



The User Group of the RMON MIB specified in accor- 
dance with the present embodiment is described in the Code 
Section below. The User Group provides a table listing 
information regarding user sessions. 

Code Section C — User Group 



60 



userTable OBJECT-TYPE 

SYNTAX SEQUENCE OF UserEntry 

MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists user sessions." 
::■ { user 1 } 
userEntry OBJECT-TYPE 
65 SYNTAX UserEntry 

MAX-ACCESS not-accessible 
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Code Section E — Memory Group 



STATUS current 
DESCRIPTION 

"A conceptual row in the userTable." 
INDEX { syslndcx, sys Address, userlndex } 
::= { userTable 1 } 
UserEntry SEQUENCE { 

userlndex Integer, 
userName DisplayString 

} 

userlndex OBJECT-TYPE 

SYNTAX Integer32 (1 65535) 

MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"Basic row index that uniquely identifies a particular user 



{ userEntry 1 } 
userName OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

'The name of the user session. 
Example: 'User One'." 
::- { userEntry 2 } 



memTable OBJECT-TYPE 

SYNTAX SEQUENCE OF MemEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that shows the memory properties." 
::- { mem 1 } 
10 memEntry OBJECT-TYPE 

SYNTAX MemEntry 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the memTable." 
15 INDEX { syslndex, sys Address } 
:> { memTable 1 } 
MemEntry SEQUENCE { 
memUsage 
memSwapSpaceLimit 
memPhysicalMcmTotal 
2Q memPhysicalMemAvailablc 
memPhysical MemFileCache 
memPageFaults 
memPagelns 
memPageOuts 



Integei32, 
Integer32, 
Integer32, 
Integer32, 
Integer32, 
Integer32, 
Integer32, 
Integer32 



25 



The Central Processing Unit (CPU) Group of the RMON 
MIB specified in accordance with the present embodiment is 
described in the Code Section below. The CPU Group 
includes a table showing CPU usage. 



Code Section D — CPU Group 



35 



cpuTable OBJECT-TYPE 

SYNTAX SEQUENCE OF CpuEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A table that shows CPU usage." 

: : - { cpu 1 } 
cpuEntry OBJECT-TYPE 

SYNTAX CpuEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the cpuTable." 
INDEX { syslndex, sysAddxcss } 

: : - { cpuTable 1 } 
CpuEntry : : - SEQUENCE { 

cpuUsage Integer32 

} 

cpuUsage OBJECT-TYPE 
SYNTAX Integer32 (0 . . 100) 

MAX- ACCESS read-only 
STATUS current 
DESCRIPTION 

"The average percentage of time that all processors on the 

system are executing non-idle threads. 

Example: 6 

: : = { cpuEntry 1 } 



} 

memUsage OBJECT-TYPE 

SYNTAX Integer32 (0.. 429 49 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The amount of virtual memory in use by all processes, in KB. 
Example: 71836 

::= { memEntry 1 } 
memSwapSpaceLimit OBJECT-TYPE 

SYNTAX Integer32 (0. .42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The amount of swap space, in KB, that can be committed to all 
processes without enlarging the swap file. 
Example: 118520 

:> { memEntry 2 } 
4 0 memPhysical MemTotal OBJECT-TYPE 

SYNTAX Integer32 (0. .42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The amount of physical random access memory installed in the 
system, in KB. 
Example: 32180 



::= { memEntry 3 } 
memFhysicalMernAvailable OBJECT-TYPE 

SYNTAX Integer32 (0. .42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

The amount of physical memory available to processes, in KB. 
Example: 3956 



45 



50 



::= { memEntry 4 } 
55 memPhysicalMemfnleCache OBJECT-TYPE 

SYNTAX Integer32 (0. .42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

The amount of physical memory released to the file cache on 
60 demand, in KB. 

Example: 9796 



The Memory Group of the RMON MIB specified in 
accordance with the present embodiment is described in the 
Code Section below. The Memory Group provides a table 65 
that shows memory properties such as the available memory 
in a data storage device and in a random access memory unit. 



:> { memEntry 5 } 
memPageFaults OBJECT-TYPE 

SYNTAX Integer32 (0..4294967295) 

MAX-ACCESS read-only 
STATUS current 
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-continued 



DESCRIPTION 

"The number of pages faulted per second. It includes both hard 
faults (those that require disk access) and soft faults (where 
the faulted page is found elsewhere in physical memory.) 
Example: 123 

::- { memEntry 6 } 
memPagelns OBJECT-TYPE 

SYNTAX Integer32 (0.. 42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of pages per second read from disk to resolve hard 
page faults. (Hard page faults occur when a process refers to 
a page in virtual memory that is not in its working set or 
elsewhere in physical memory, and must be retrieved from disk.) 
When a page is faulted, the system tries to read multiple 
contiguous pages into memory to maximize the benefit of the 
costly read operation. 
Example: 42 

::= { memEntry 7 } 
memPageOuts OBJECT-TYPE 

SYNTAX Integer32 (0.. 42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of pages per second written to disk to free up 

space 

in physical memory. Pages are written back to disk only if 
they are changed in physical memory, so they are likely to hold 
data, not code. A high rate of pages output might indicate a 
memory shortage. 
Example: 5 



15 



20 



::- { memEntry 8 } 



The Drive Group of the RMON MIB specified in accor- 
dance with the present embodiment is described in the Code 
Section below. The Drive Group provides information 
regarding the hard disk performance, drive properties, and 
drive controller properties, and includes a hard disk table, a 
drive table, and a drive controller table. 

Code Section F — Drive Group 



- Hard Disk Table 
driveHardDiskTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DriveHardDiskEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A table that lists the hard disk performance." 

::- { drive 1 } 
driveHardDiskEntry OBJECT-TYPE 

SYNTAX DriveHardDiskEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the driveHardDiskTable." 

INDEX { syslndex, sys Address } 

::- { driveHardDiskTable 1 } 
DriveHardDiskEntry ::- SEQUENCE { 

driveHardDiskReadRate Integer32, 

driveHardDiskWriteRate Integer32 

} 

driveHardDiskReadRate OBJECT-TYPE 

SYNTAX Integer32 (0..4294967295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Bytes per second transferred from all hard disks during read 

operations." 



{ driveHardDiskEntry 1 } 
driveHardDiskWriteRate OBJECT-TYPE 
5 SYNTAX Integer32 (0. .42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Bytes per second transferred to all hard disks during write 
operations." 
10 ::- { driveHardDiskEntry 2 } 
- Drive Table 
driveTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DriveEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists all the drive letter properties." 
{ drive 2 } 
driveEntry OBJECT-TYPE 

SYNTAX DriveEntry 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the driveTable." 
INDEX { syslndex, sys Address, drivelndex } 
:> { driveTable 1 } 
DriveEntry ::- SEQUENCE { 
drivelndex Integer32, 
25 driveLetter Display String, 

driveType Display String, 

driveFileSystem INTEGER, 
driveTotal Intcger32, 
driveFrce Intcger32 

} 

30 drivelndex OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"An index that uniquely identifies a drive of the 
system uniquely identified by syslndex and sysAddress." 
::■ { driveEntry 1 } 
driveLetter OBJECT-TYPE 

SYNTAX Display String (SIZE (0. .1 27)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Drive letter - the DOS/Windows convention of drive letter 
assigned to a logical partition. 
Examples: 'C:' 
'A:'." 
::= { driveEntry 2 } 
driveType OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 
"Example: 

'Removable drive' for floppy, Jaz, Zip, etc, 
50 'Fixed drive' 

'Wenab dev\public' shows network share point 

'CD-ROM drive'." 
::- { driveEntry 3 } 
driveFileSystem OBJECT-TYPE 
SYNTAX INTEGER { 

55 



35 



40 



45 



65 



Othe^l), 




Unknown(2), 




NoDiskLoadcd(3) 




FATT4), 




FAT32(5) J 




NTFS(6), 




HPFS(7), 


- OS/2 High Per- 




formance File System 


BerkeleyFFS(8), 




Sys5FS(9), 




HFS(10), 


Macintosh Hier- 




archical File System 


MFS(ll), 


— Macintosh File 




System 


IS09 660(1 2), 


- CD File System 
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} 



UDF(13), 
NFS(14), 
Netware (15) 



MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Identifies the file system of the drive, or indicates that the 

disk is not loaded for removable drive." 
{ driveEntry 4 } 
driveTotal OBJECT-TYPE 

SYNTAX Integcr32 (0.. 429 49 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The total capacity of the drive, in KB. 

Example: '4,193,280'." 
::» { driveEntry 5 } 
driveFree OBJECT-TYPE 

SYNTAX Integer32 (0.. 4294967295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The free space on the drive, in KB. 

Example: '839,476'." 
::- { driveEntry 6 } 
- Drive Controller Table 
driveControllerTable OBJECT-TYPE 

SYNTAX SEQUENCE OF DriveControllerEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists the drive controller properties." 
::= { drive 3 } 
drivcControllerEntry OBJECT-TYPE 
SYNTAX DriveEntry 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the driveTable." 
INDEX { syslndex, sys Address, driveControllerlndex } 
::= { driveTableController 1 } 
DriveEntry ::= SEQUENCE { 

driveControllerlndex Integer32, 
driveControllerType INTEGER, 
driveContro llerDescr Disp la yString, 

driveControllerFirmwareDescr DisplayString 

} 

driveControllerlndex OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"An index that uniquely identifies a drive controller of the 
system uniquely identified by syslndex and sysAddress." 
::= { driveControllerEntry 1 } 
driveControUerType OBJECT-TYPE 
SYNTAX INTEGER { 

Other(l), 
Unknown(2), 
UltraDMA33(3), 
SCSIUltraWideSingleEnded(4), 
SCSIUltra80LVDS(5), 
IEEE1 394(6) 

} 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Identifies the type of the drive controller." 
::= { driveControllerEntry 2 } 
driveControllcrDcscr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Description of the drive controller by including the 

manufacturer, product name, and model. 

Example: 

•Adaptec AHA-294X PCI SCSI Controller'." 



::- { driveControllerEntry 3 } 
driveControllerFirmwareDescr OBJECT-TYPE 



DisplayString (SIZE (0..127)) 

read-only 

current 



10 



SYNTAX 
MAX-ACCESS 
STATUS 
DESCRIPTION 

"Description of the drive controller firmware by the firmware 

version. 

Example: 

'BIOS Version 1.25, 01/9/97'." 
::= { driveControllerEntry 4 } 



15 



The Application Group of the RMON MIB specified in 
accordance with the present embodiment is described in the 
Code Section below. The Application Group provides a 
summary of applications residing on the computer system 
and lists the application properties, and includes an appli- 
cations summary table and an application table. 

Code Section G — Application Group 



25 



30 



45 



50 



60 



65 



Application Summary Table 
appSummaryTable OBJECT-TYPE 

SYNTAX SEQUENCE OF AppSummaryEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A table that lists summaries of all applications." 

::= { app 1 } 
appSummaryEntry OBJECT-TYPE 

SYNTAX AppSummaryEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the appSummaryTable." 

INDEX { syslndex, sysAddress } 

::= { appSummaryTable 1 } 
AppSummaryEntry ::= SEQUENCE { 

appSummaryNumber Counter32 

} 

appSummaryNumber OBJECT-TYPE 
SYNTAX Counter32 
MAX- ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of applications in the system. 

Example: 4 

::= { appSummaryEntry 1 } 
-- Application Table 
appTable OBJECT-TYPE 

SYNTAX SEQUENCE OF AppEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A table that lists application properties " 

::- { app 2 } 
appEntry OBJECT-TYPE 

SYNTAX AppEntry 

MAX- ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the appTable." 

INDEX { syslndex, sysAddress, applndex } 

::= { appTable 1 } 
AppEntry ::- SEQUENCE { 

applndex Integer32, 

appHtle DisplayString, 

appState INTEGER, 

appDescr DisplayString 

} 

applndex OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 
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MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"Basic row index that uniquely identifies a particular 
application." 
::= { appEntry 1 } 
appTitle OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

'Title of the application. 
Example: 
'Internet Explorer'." 
::» { appEntry 2 } 
appState OBJECT-TYPE 

SYNTAX INTEGER { 

Unknown(l), 
Running (2), 
NotResponding(3) 

} 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The state of the application." 
::- { appEntry 3 } 
appDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Description of the application by including the manufacturer, 

product name, and version. 

Example: 

'Microsoft Internet Explorer 4.0'." 
::= { appEntry 4 } 



The Process Group of the RMON MD3 specified in 
accordance with the present embodiment is described in the 
Code Section below. The Process Group provides a sum- 
mary of the processes utilized by the computer system and 
lists the process properties, and includes a process summary 
table and a process table. 

Code Section H — Process Group 



-- Process Summary Table 
processSutnmaryTable OBJECT-TYPE 

SYNTAX SEQUENCE OF ProcessSummaryEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists summaries of all processes." 
::- { process 1 } 
processSurnmaryEntry OBJECT-TYPE 

SYNTAX ProcessSummaryEntry 
MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A conceptual row in the processSummaryThble." 
INDEX { syslndex, sysAddress } 
::= { processTable 1 } 
ProcessSummaryEntry ::« SEQUENCE { 

processSummary Number Counter32 



20 



} 

processSummaryNumbcr OBJECT-TYPE 
SYNTAX Counter32 
MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of processes in the system. 
Example: 26 



{ processSurnmaryEntry 1 } 
— Process Table 
s ProcessTable OBJECT-TYPE 

SYNTAX SEQUENCE OF proccssEntry 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"A table that lists process properties." 
10 ::« { process 2 } 

processEntiy OBJECT-TYPE 

SYNTAX ProcessEntry 
MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 
25 "A conceptual row in the processTable." 

INDEX { syslndex, sysAddress, processlndex } 
{ processTable 1 } 
ProcessEntry ::=* SEQUENCE { 

processlndex Integer32, 
processTitle DisplayString, 
processState INTEGER, 
processff) Integer32, 
processCPU Usage Integer32, 
processWorkingSet Integer32, 
processPageFaults Integer32, 
processBasePriority INTEGER, 
processFilePath DisplayString 

25 } 

processlndex OBJECT-TYPE 

SYNTAX Integer32 (1.. 65535) 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

30 "Basic row index that uniquely identifies a particular process.'' 

::« { proccssEntry 1 } 
processTitle OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Title of the process. 
Example: 

'RAS Server'." 
::« { processEntry 2 } 
processState OBJECT-TYPE 

SYNTAX INTEGER { 

Unknown(l), 
Running(2), 
NotRespond ing(3) , 
Suspended(4), 
Terminated(S) 

} 

4 5 MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The state of the process," 
::- { processEntry 3 } 
processID OBJECT-TYPE 
50 SYNTAX Integer32 (1.. 65535) 

MAX- ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"Identification number of the process. 
Example: 2 

55 

::= { processEntry 4 } 
processCPUUsage OBJECT-TYPE 

SYNTAX Intcgcr32 (0..1O0) 

MAX- ACCESS read-only 
STATUS current 
DESCRIPTION 

"The percentage of time the threads of the process using the 
processors. 
Example: 98 



■35 



40 



60 



::= { processEntry 5 } 
processWorkingSet OBJECT-TYPE 
65 SYNTAX Integer32 (0. .42949 67295) 

MAX- ACCESS read-only 
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-continued 



-continued 



STATUS current 
DESCRIPTION 

"The number of KB in the Working Set of this process. The 

Working Set is the set of memory pages touched recently by the 

threads of the process. 

Example: 5388 

{ processEntry 6 } 
processPageFaults OBJECT-TYPE 

SYNTAX Iateger32 (0.. 42949 67295) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The number of pages faulted per second by the threads of the 

process. 

Example: 1 

::= { processEntry 7 } 
processBasePriority OBJECT-TYPE 
SYNTAX INTEGER { 

Normal(l), 

High(2), 

Low(3) 

} 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The current base priority of this process. Threads within a 

process can raise and lower their own base priority relative to 

the process* base priority." 
::= { processEntry 8 } 
processFilePath OBJECT-TYPE 

SYNTAX DisplayString (SIZE (0..127)) 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The file path of the process. 

Example: 

'd:\winnt\s ystem32\RASSRV.EXE t ." 
::= { processEntry 9 } 



10 
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"The number of errors in the system. 
Example: 1 

: : «» { errorSummary Entry 1 } 
~ Error Table 
errorTable OBJECT-TYPE 

SYNTAX SEQUENCE OF error] 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 
"A table that lists error properties." 

: : = { error 2 } 
errorEntiy OBJECT-TYPE 

SYNTAX ErrorEntry 

MAX-ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the errorTable." 

INDEX { syslndex, sysAddress, processlr 

: : = { errorTable 1 } 
ErrorEntry : : - SEQUENCE { 



errorlndex 
errorDescr 
errorTime 
errorSeverity 



Integer32, 
DisplayString, 
TimeStarnp, 
INTEGER 



35 



} 

errorlndex OBJECT-TYPE 

SYNTAX Integer32 (1 . . 65535] 

MAX-ACCESS not-accessible 
STATUS current 
DESCRIPTION 

"Basic row index that uniquely identific 
: : = { errorEntry 1 } 
errorDescr OBJECT-TYPE 

SYNTAX DisplayString (SIZE (( 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"Description of the error. 

Example: 



The Error Group of the RMON MIB specified in accor- 
dance with the present embodiment is described in the Code 
Section below. The Error Group lists a summary of errors 40 
and error properties, and includes an error summary table 
and an error table. 



lex } 



a particular error." 



. . 1023)) 



* [DjeviceBcsiO timeout'." 

: : = { errorEntry 2 } 
crrorTime OBJECT-TYPE 

SYNTAX TimeStarnp 

MAX-ACCESS read-only 

STATUS current 

DESCRIPTION 
"The value of sysUpTime when the error was detected." 

: : = { errorEntry 3 } 
errorSeverity OBJECT-TYPE 

SYNTAX INTEGER { 

Red(l) 

Yellow(2), --Warning 
Green(3) - Informational only 

MAX-ACCESS read-only 
STATUS current 
DESCRIPTION 

"The severity of the error." 
: : - { errorEntry 4 } 
END 



SYSTEM INFORMATION — OPERATION 

Refer now to FIG. 6, which illustrates the memory 
structure within the computer-readable memory units of 
client computer system 110 and also in server computer 
system 250 of FIG. 2 in one embodiment of the present 
invention. Host group 600 is used to store the system 
information described by the Code Sections above. It is 
appreciated that host group 600 exemplifies a subset of the 
system information described by the Code Sections above, 
and that in another embodiment, host group 600 contains 
system information specified by the RMON MIB of the 
present embodiment of the present invention. 

In one embodiment, the information in host group 600 is 
periodically transmitted to a central computer system (e.g., 



Code Section I — Error Group 

45 



- Error Summary Table 
errorSummaryTable OBJECT-TYPE 

SYNTAX SEQUENCE OF ErrorsummaryEntry 

MAX- ACCESS not-accessible 50 

STATUS current 

DESCRIPTION 

"A table that lists summaries of all errors." 

: : - { error 1 } 
errorSummaryEntry OBJECT-TYPE 

SYNTAX ErrorSummaryEntry 55 

MAX- ACCESS not-accessible 

STATUS current 

DESCRIPTION 

"A conceptual row in the errorSummaryTable." 

INDEX { syslndex, sysAddress } 

: : - { errorTable 1 } 
ErrorSummaryEntry : : = SEQUENCE { 60 

errorSummary Number Counter32 

} 

errorSummaryNumber OBJECT-TYPE 
SYNTAX Counter32 
MAX-ACCESS read-only 

STATUS current 65 

DESCRIPTION 
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edge monitor 300 of FIG. 3) at a time interval established by 
the network manager. In one embodiment, the information in 
host group 600 is transmitted to edge monitor 300 when the 
information changes from a value previously communicated 
to the edge monitor. The information in host group 600 is 
time -stamped to indicate the time interval corresponding to 
when the information was collected. 

With reference to FIG. 6, MAC (Medium Access Control) 
Address 601 identifies the particular host computer system 



assignee of the present invention, entitled "Method for 
Analyzing Network Application Flows in an Encrypted 
Environment," by Richard A. Fletcher and Carl Lin, with 
Ser. No. 09/143,273, also incorporated herewith by 
reference, and still pending. 

In step 702 of FIG. 7, in the present embodiment, the 
network performance statistics are stored in a memory unit 
(e.g., user-history table 560 of FIG. 5) of a host computer 
system (either the client computer system or the server 
computer system) for each time interval. In the present 



to the edge monitor. IF (Interface) Number 602 identifies the io embodiment, the network performance statistics are time- 



particular segment (e.g., segment 305 of FIG. 3) to the 
central computer system. In this manner, edge monitor 300 
can identify the specific host computer system associated 
with the system information received and catalogued by the 
edge monitor. In addition, edge monitor 300 can identify the 
network segment associated with the system information. 

Continuing with reference to FIG. 6, other information 
stored in host group 600 in one embodiment is exemplified. 
Incoming data packets 603 represent the number of data 
packets received by the host computer (e.g., request data 
packet 290 received by server computer system 250 and 
response data packet 295 received by client computer sys- 
tem 110 of FIG. 2). Outgoing data packets 604 represent the 
number of data packets sent by the host computer (e.g., 
request data packet 290 sent by client computer system 110 



stamped by the host computer system to indicate the time 
interval over which the statistics were measured and col- 
lected so that historical data can be identified by its collec- 
tion period. Additional information is provided in the above- 
named copending patent applications. Additional 
information is also provided in the copending patent appli- 
cation entitled Title "Distributed Remote Moniroting 
(DRMON) for Network" Filing Date Jun. 24, 1997, with 
Ser. No, 08/882,207. 

In step 703 of FIG. 7, concurrently with the collection of 
20 the network performance statistics, system information is 
collected by each host computer system regarding its own 
capabilities and performance. In other words, client com- 
puter system 110 measures and stores system information 
regarding its capabilities and performance, and server com- 
puter system 250 measures and stores system information 



and response data packet 295 sent by server computer 25 regarding its capabilities and performance. In the present 
system 250). CPU (central processing unit) usage 605 rep- embodiment, the system performance statistics and system 
resents the amount of computer memory available (e.g., parameters collected by the host computer are as described 
random access memory 102, read-only memory 103, and in the Code Sections above. 

data storage device 104 of FIG. 1), including the total In step 704 of FIG. 7, in the present embodiment, the 
memory available and the amount of memory being used, 30 system information for each host computer system is stored 



and thus the remaining memory available. 

In one embodiment, host group 600 of FIG. 6 also 
includes processes list 606 and applications list 607, which 
provide a compilation of the processes and applications 
residing in the host computer. Host group 600 is not limited 
to listing only the network processes and network applica- 
tions. Using processes list 606 as an example in FIG. 6, the 
processes residing in the host computer are referenced to 
process group 608 by process index 609. Process group 608 
includes a tabulation by process index 609 of processes 610 
and also includes process attributes 611. In this embodiment, 
an analogous application group is referenced by host group 
600. 

APPLICATION TO INTEGRATED SYSTEM AND NET- 
WORK MONITORING 



in a memory unit (e.g., host group 600 of FIG. 6) of each 
host computer system for each time interval. In the present 
embodiment, the system information is time-stamped by the 
host computer system to indicate the time interval over 
which the information was measured and collected so that 
historical data can be identified by its collection period. 

In step 705 of FIG. 7, the network performance statistics 
are communicated over the communication network to a 
central computer system (e.g., edge monitor 300 of FIG. 3) 
as described in the concurrent applications referenced 
above. In step 706, the system information is also commu- 
nicated over the communication network to edge monitor 
300. In one embodiment, updated system information is 
communicated to edge monitor 300 at predetermined 
intervals, e.g., at 30-second intervals, although it is appre- 



The present invention enables the network manager to 45 ciated that other time intervals can be specified in accor- 

integrally view network performance statistics and system dance with the present invention. In an alternative 

information that correspond to a contemporaneous time embodiment, system parameters and system performance 

period and also correspond to the time that a problem on the statistics are communicated to the edge monitor only when 

communication network occurs. a value changes from a value previously communicated to 

FIG. 7 illustrates a process 700 for collecting network and 50 the edge monitor. 



system information, where process 700 is implemented as 
program instructions stored in computer-readable memory 
units of client computer system 110 (FIG. 2) and executed 
by central processor 101 (FIG. 1), and also stored and 
executed on server computer system 250 (FIG. 2). 

With reference to FIG. 7, in step 701 of the present 
embodiment, the network performance statistics described 
above are collected over a predetermined time interval for a 
client computer system and a server computer system (e.g., 
client computer system 110 and server computer system 250 
of FIG. 2) using the method described in the copending 
patent application filed herewith, assigned to the assignee of 
the present invention, entitled "Application Response Time 
and Network Latency Monitoring Using End-Node Com- 
puter Systems," by Richard A. Fletcher and Prakash C. 



FIG. 8 illustrates a process 800 for collecting network and 
system information, where process 800 is implemented as 
program instructions stored in computer-readable memory 
units of edge monitor 300 (FIG. 3) and executed by central 
55 processor 101 (FIG. 1). In step 801, the network perfor- 
mance statistics determined by client computer system 110 
and server computer system 250 and communicated to edge 
monitor 300 are stored in a memory unit of edge monitor 
300. As noted above, the network performance statistics are 
time-stamped to indicate the time interval over which the 
60 statistics were collected. The network performance statistics 
are accumulated and retained in edge monitor 300 for a 
period of time specified by the network manager. Thus, in 
the present embodiment, historical information and recent 
updates to the historical information are provided by the 



Banthia, with Ser. No. 09/141,968, incorporated herewith by 65 network performance data stored in edge monitor 300. 
reference, and still pending; and as described in the copend- In step 802 of FIG. 8, the system information determined 
ing patent application filed herewith, assigned to the by a host computer system (e.g., client computer system 110 
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or server computer system 250) and communicated to edge 
monitor 300 are stored in a memory unit of the edge monitor. 
As noted above, the system information is time -stamped to 
indicate the time interval over which the information was 
collected. The system information is accumulated over time s 
and retained in edge monitor 300 for a period of time 
specified by the network manager. Thus, in the present 
embodiment, historical information and recent updates to 
the historical information are provided by the system infor- 
mation data stored in edge monitor 300. 

In step 803 of FIG. 8, in the present embodiment, edge 10 
monitor 300 uses the time-stamps to correlate the network 
performance statistics and the system information collected 
over concurrent time periods. That is, the network perfor- 
mance statistics corresponding to a particular time interval 
are correlated to the system information corresponding to a 15 
contemporaneous time interval. In this manner, the present 
invention enables the network manager to integrally view 
corresponding network performance statistics and system 
information for a selected time interval, or for the time 
interval corresponding to the identification of a perturbation 
in the communication network. Additional information is 20 
provided by the copending patent application entitled system 
and method for providing information to applets in a virtual 
machine Ser. No. 08/873,440, now U.S. Pat. No. 5,922,044. 
The network and system information provided the present 
invention also enables the network manager to demonstrate 25 
compliance with a governing service level agreement. 

With reference back to FIG. 3, an example is provided to 
illustrate the application of the present invention. A user of 
client computer system 110 is experiencing longer response 
times when running a network application over the commu- 30 
nication network. In one embodiment, the present invention 
is monitoring application response time (refer to FIG. 4) 
between client computer system 110 and server computer 
system 250 and reporting the statistical results to edge 
monitor 300 as described above. In this embodiment, edge 35 
monitor 300 detects that application response time is greater 
than a predetermined limit and triggers an alarm in order to 
bring the potential problem to the attention of the network 
manager. 

Continuing with the example, in response to the alarm, the 
network manager accesses edge monitor 300 to begin an 40 
investigation into the slow response time by reviewing 
network latency statistics (refer to FIG. 4) to determine if 
there is a problem with communication line 240, or with a 
router or switch (not shown) on that line. The network 
manager accesses the historical network performance data 45 
corresponding to the period of time contemporary to the 
time the perturbation occurred or was identified as indicated 
by the alarm or by a trouble report. If a problem is not 
indicated in the network equipment, the network manager is 
able to use system information corresponding to the same 50 
time period (e.g., the period of time contemporary to the 
time the perturbation occurred or was identified) and stored 
in edge monitor 300 to review the system information 
pertaining to client computer system 110 and server com- 
puter system 250. For example, the network manager might 55 
review the remaining amount of memory available or the 
number of page faults occurring in server computer system 
250 in order to determine if the server computer system is 
"thrashing" because it is being overloaded by other users or 
by too many large network applications. Hence, in this 
manner the present invention provides integrated computer 60 
system and network monitoring to enable a network man- 
ager to integrally evaluate network and system information 
to readily ascertain the cause of a problem on the commu- 
nication network. The present invention correlates the net- 
work and system information according to the time interval 65 
over which the information was collected, and the network 
manager is able to view the correlated information for the 
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time period contemporaneous with the identification of a 
perturbation in the communication network. 

In summary, the present invention provides system infor- 
mation for the host computer systems on a communication 
network and, in conjunction with the concurrent applications 
referenced above, the present invention also provides net- 
work information. The present invention allows the network 
manager to integrally review both network and system 
performance data by providing that data in one location. The 
present invention provides access to historical data and 
recent updates to that data. Using the time-stamps applied to 
the data, the present invention correlates the network infor- 
mation and system information, so that the network manager 
is able to review a "snap shot" of the events that were 
occurring concurrently in the network and in the computer 
system during the period of time when a perturbation or 
problem in the communication network is identified. Based 
on the information provided using the present invention, the 
network manager is able to identify whether the source of a 
problem is with the communication network equipment or 
with a host computer system on the network. Thus, in 
accordance with the present invention, the network manager 
can then focus on either the communication network or on 
the computer system, and use the information provided by 
the present invention to determine the cause of the problem. 

The present invention provides a method to monitor a 
communication network that enables the network manager 
to readily detect a problem and determine the cause of the 
problem. Using the data provided by the present invention, 
the network manager is also able to demonstrate compliance 
with a service level agreement. The present embodiment of 
the present invention is implemented using an extension to 
an RMON MIB and is therefore compatible with SNMP 
protocol. 

The preferred embodiment of the present invention, inte- 
grated computer system and network performance 
monitoring, is thus described. While the present invention 
has been described in particular embodiments, it should be 
appreciated that the present invention should not be con- 
strued as limited by such embodiments, but rather construed 
according to the following claims. 

What is claimed is: 

1. In a communication network comprising computer 
systems communicatively coupled with communication 
equipment, a method for monitoring communication perfor- 
mance comprising the steps of: 

a) a computer system measuring and time-stamping net- 
work performance statistics and storing said network 
performance statistics in a memory unit of said com- 
puter system; 

b) said computer system measuring and time-stamping 
system information and storing said system informa- 
tion in said memory unit of said computer system, 
wherein said system information recites system perfor- 
mance statistics and system parameters of said com- 
puter system, wherein said steps a) and b) are per- 
formed concurrently; 

c) said computer system reporting said network perfor- 
mance statistics and said system information to a 
central computer system at specified time intervals, 
wherein said network performance statistics and said 
system information are indexed to said computer sys- 
tem; and 

d) said central computer system correlating network per- 
formance statistics measured during a specified time 
interval with system information measured during said 
specified time interval based on said time-stamping and 
storing said network performance statistics and said 
system information in a memory unit of said central 
computer system. 
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2. The method as recited in claim 1 further comprising the 
step of: 

e) said central computer system displaying correlated 
network performance statistics and system information 
in response to identification of a perturbation in said 
communication network, wherein said correlated net- 
work performance statistics and system information are 
displayed for a time interval contemporaneous with 
said perturbation. 

3. The method as recited in claim 1 wherein said computer 
system is a client computer system. 

4. The method as recited in claim 1 wherein said computer 
system is a server computer system. 

5. The method as recited in claim 1 wherein step a) further 
comprises measuring application response time. 

6. The method as recited in claim 1 wherein step a) further 
comprises measuring application processing time. 

7. The method as recited in claim 1 wherein step a) further 
comprises measuring network latency. 

8. The method as recited in claim 1 wherein step a) further 
comprises measuring protocol latency. 

9. The method as recited in claim 1 wherein step b) is 
implemented using a management information base exten- 
sion to Remote Network Monitoring (RMON) -based com- 
puter software, said management information base extension 
specifying said system information. 

10. The method as recited in claim 1 wherein step b) 
further comprises measuring page faults by said computer 
system. 

11. The method as recited in claim 1 wherein step b) 
further comprises measuring errors by said computer sys- 
tem. 

12. The method as recited in claim 1 wherein step b) 
further comprises measuring hardware capabilities of said 
computer system. 

13. The method as recited in claim 12 further comprising 
the step of quantifying available memory in a data storage 
device of said computer system. 

14. The method as recited in claim 12 further comprising 
the step of quantifying available memory in a random access 
memory unit of said computer system. 

15. The method as recited in claim 1 wherein step b) 
further comprises identifying network applications utilized 
by said computer system. 

16. The method as recited in claim 1 wherein step b) 
further comprises identifying processes utilized by said 
computer system! 

17. A computer system comprising: 
a processor coupled to a bus; and 

a memory unit coupled to said bus and having stored 
therein instructions that when executed by said proces- 
sor implement a method for monitoring communication 
performance of a communication network comprising 
computer systems communicatively coupled to each 
other, said method comprising the steps of: 

a) measuring and time-stamping network performance 
statistics and storing said network performance sta- 
tistics in said memory unit of said computer system; 

b) measuring and time-stamping system information 
and storing said system information in said memory 
unit of said computer system, wherein said system 
information recites system performance statistics 
and system parameters of said computer system, 
wherein said steps a) and b) are performed concur- 
rently; and 

c) reporting said network performance statistics and 
said system information to a central computer system 
at specified time intervals, wherein said network 
performance statistics and said system inform ation 
are indexed to said computer system; wherein 
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d) said central computer system correlates network 
performance statistics measured during a specified 
time interval with system information measured dur- 
ing said specified time interval based on said time- 
5 stamping and storing said network performance sta- 

tistics and said system information in a memory unit 
of said central computer system. 
18. The computer system as described in claim 17 
wherein said computer system is a client computer system. 
10 19. The computer system as described in claim 17 
wherein said computer system is a server computer system. 

20. The computer system as described in claim 17 
wherein said network performance statistics measure appli- 
cation response time, application processing time, network 

15 latency and protocol latency. 

21. The computer system as described in claim 17 
wherein said system information is specified in a manage- 
ment information base extension to Remote Network Moni- 
toring (RMON)-based computer software. 

20 22. The computer system as described in claim 17 
wherein said system performance statistics measure page 
faults and errors by said computer system. 

23. The computer system as described in claim 17 
wherein said system parameters measure hardware capabili- 

25 ties of said computer system. 

24. The computer system as described in claim 17 
wherein said system parameters identify network applica- 
tions and processes utilized by said computer system. 

25. In a communication network comprising computer 
30 systems communicatively coupled with communication 

equipment, a method for monitoring communication perfor- 
mance comprising the steps of: 

a) a computer system measuring and time-stamping net- 
work performance statistics and storing said network 

35 performance statistics in a memory unit of said com- 
puter system; 

b) said computer system measuring and time -stamping 
system information and storing said system informa- 
tion in said memory unit of said computer system, 

40 wherein said system information is specified by a 
management information base extension to Remote 
Network Monitoring (RMON)-based computer 
software, wherein said steps a) and b) are performed 
concurrently; 

c) said computer system reporting said network perfor- 
mance statistics and said system information to a 
central computer system at specified time intervals, 
wherein said network performance statistics and said 

50 system information are indexed to said computer sys- 
tem; 

d) said central computer system correlating network per- 
formance statistics measured during a specified time 
interval with system information measured during said 

55 specified time interval based on said time-stamping and 
storing said network performance statistics and said 
system information in a memory unit of said central 
computer system; and 

e) said central computer system displaying correlated 
60 network performance statistics and system information 

in response to identification of a perturbation in said 
communication network, wherein said correlated net- 
work performance statistics and system information are 
displayed for a time interval contemporaneous with 
65 said perturbation. 

# + * * * 
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